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Amendments to the Claims : 

This listing of claims replaces all prior versions and listings of claims in the application: 
Listing of Claims : 

1 . (Currently Amended) A memory device storing a data structure for tracking network 
behavior, comprising: 

a connection table that maps each node of a network to a record [object] that stores 
information about traffic to or from the node and between that node and others nodes in the 
network. 

2. (original) The device of claim 1 wherein the connection table includes a plurality of 
records that are indexed by source address. 

3. (original) The device of claim 1 wherein the connection table includes a plurality of 
records that are indexed by destination address. 

4. (original) The device of claim 1 wherein the connection table includes a plurality of 
records that are indexed by time. 

5. (Currently Amended) The device of claim 1 wherein the connection table includes a 
plurality of records , that are record objects, which that are indexed by source address, destination 
address and time. 

6. (original) The device of claim 1 wherein the connection table is a plurality of 
connection sub-tables each sub-table having data pertaining to network traffic over different time 
scales. 
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7. (Currently Amended) The device of claim 4- 6 wherein the connection sub-tables 
include a time-slice connection table that operates on a small unit of time and at least one other 
sub-table that operates on a larger unit of time than the time slice sub-table. 

8. (original) The device of claim 7 wherein the at one sub-table holds records received 
from all collectors over the time scale of the table. 

9. (original) The device of claim 5 wherein the addresses indexing the connection table 
are IP addresses. 

10 (Previously Presented) The device of claim 1 wherein the addresses indexing the 
connection table include a physical layer address to IP address map that is used to determine 
Host ID. 

1 1 . (Currently Amended) The device of claim 1 wherein the host record of a first host 
maps that first host to a second host that communicates with the first host to a [["]]host pair 
record object[["]] that has information about all the traffic from the first to the second host and 
from the second host to the first host. 

12. (Previously Presented) The device of claim 1 wherein the connection table includes 
two level mapping that enables a consuming device to obtain summary information about one 
host for a first level mapping and about the traffic between any pair of hosts, in either direction, 
between a first one of the hosts of the any pair to a second one of the hosts of the any pair and 
from the second one of the hosts of the any pair to the first one of the hosts of the any pair for a 
second level mapping. 
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13. (Currently Amended) The device of claim 1 wherein the connection table comprises a 
plurality of host records, a host record stores a measure of the number of bytes, packets, and 
connections that occurred between hosts during a giv e n time-period. 

14. (Currently Amended) The device of claim T 13 wherein data in the host record is 
organized by well known transport protocols and well-known application-level protocols. 

15. (Currently Amended) The device of claim 4- 13 wherein host records have no specific 
memory limit. 

16. (original) The device of claim 1 wherein for application-level protocols and for every 
pair of hosts, the connection table stores statistics for traffic between the hosts. 

17. (original) The device of claim 16 wherein the connection table stores protocol- 
specific records as (protocol, count) key-value pairs. 

18. (New) A memory device storing a data structure for tracking network behavior, the 
data structure comprising: 

a connection table that maps each node of a network to a record that stores connection 
information about traffic to or from the node and between that node and others nodes that have 
connections with the node in the network, the connection table indexed according to at least a 
first one of source address, destination address and time; 

the connection table further including in the records fields for storing statistical 
information for traffic between the hosts. 



20. (New) The device of claim 18 wherein the plurality of records is record objects. 
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21. (New) The device of claim 18 wherein the connection table is a second plurality of 
connection sub-tables, each sub-table having data pertaining to network traffic over different 
ones of corresponding second plurality of time scales. 

22. (New) The device of claim 18 wherein the connection sub-tables include a time-slice 
connection table that operates on a small unit of time and at least one other sub-table that 
operates on a larger unit of time than the time slice sub-table. 

23. (New) The device of claim 18 wherein the at one sub-table holds records received 
from all collectors in the network over the time scale of the table. 

24. (New) The device of claim 1 8 wherein the addresses indexing the connection table 
are IP addresses. 

25. (New) The device of claim 24 wherein the addresses indexing the connection table 
include a physical layer address to IP address map that is used to determine Host ID. 

26. (New) The device of claim 1 8 wherein the host record of a first host maps that first 
host to a second host that communicates with the first host to a host pair record that has 
information about all the traffic from the first to the second host and from the second host to the 
first host. 

27. (New) The device of claim 1 wherein the connection table includes two level 
mapping that enables a consuming device to obtain summary information about one host for a 
first level mapping and about the traffic between any pair of hosts, in either direction, between a 
first one of the hosts of the any pair to a second one of the hosts of the any pair and from the 
second one of the hosts of the any pair to the first one of the hosts of the any pair for a second 
level mapping. 
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28. (New) The device of claim 1 8 wherein the connection table comprises a plurality of 
host records, a host record stores, a measure of the number of bytes, packets, and connections 
that occurred between hosts during a time-period. 

29. (New) The device of claim 28 wherein data in the host record is organized by well 
known transport protocols and well-known application-level protocols. 

30. (New) The device of claim 29 wherein for application-level protocols and for every 
pair of hosts, the connection table stores statistics for traffic between the hosts. 

31. (New) The device of claim 29 wherein the connection table stores protocol-specific 
records as (protocol, count) key-value pairs. 



